H5P vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

H5

Product

H5P

by H5P · last CVE Oct 22, 2026

4

CVEs

0

On KEV

7.1

Max CVSS

2

New 30D

Vulnerabilities4 In the news0 Timeline

Severity mix

Critical 0High 1Medium 3Low 0

Severity

All severities4 Critical0 High1 Medium3 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add H5P to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-56006	7.1	0%	Jun 25	WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 1.17.6
CVE-2026-112867 New	6.5	0%	Oct 22	WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability Affected: through 1.17.9
CVE-2024-3111	5.4	0%	Jun 27	The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored… Affected: before 1.15.8
CVE-2026-112868 New	4.3	0%	Oct 21	WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability Affected: through 1.17.9